CVE-2026-33378: Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
Using the $timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Configure the Grafana server process to automatically restart on failure (for example via systemd, a process supervisor, or your hosting platform) so that an OOM caused by negative-interval injection in the $__timeGroup macro results in minimal or no impact.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33378?
CVE-2026-33378 is rated as a moderate severity vulnerability due to its potential to cause denial of service (DoS) through out-of-memory (OOM) conditions.
How do I fix CVE-2026-33378?
To mitigate CVE-2026-33378, limit user input to the $__timeGroup macro and monitor SQL datasource configurations.
What systems are affected by CVE-2026-33378?
CVE-2026-33378 affects instances of Grafana that utilize the $__timeGroup macro with SQL datasources.
Can CVE-2026-33378 be exploited remotely?
Yes, CVE-2026-33378 can be exploited remotely if an attacker has access to the Grafana instance with the ability to issue queries.
What impact does CVE-2026-33378 have on Grafana?
The impact of CVE-2026-33378 includes the risk of server crashes due to OOM conditions, but this is minimal if the server is configured to auto-restart.